/* util.h

 * Copyright 2012 The ChromiumOS Authors

 * Use of this source code is governed by a BSD-style license that can be

 * found in the LICENSE file.

 *

 * Logging and other utility functions.

 */

#ifndef _UTIL_H_

#define _UTIL_H_

#include <stdbool.h>

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/types.h>

#include <syslog.h>

#include <unistd.h>

#include "libsyscalls.h"

#ifdef __cplusplus

extern "C" {

#endif

/*

 * Silence compiler warnings for unused variables/functions.

 *

 * If the definition is actually used, the attribute should be removed, but if

 * it's forgotten or left in place, it doesn't cause a problem.

 *

 * If the definition is actually unused, the compiler is free to remove it from

 * the output so as to save size.  If you want to make sure the definition is

 * kept (e.g. for ABI compatibility), look at the "used" attribute instead.

 */

#define attribute_unused __attribute__((__unused__))

/*

 * Mark the symbol as "weak" in the ELF output.  This provides a fallback symbol

 * that may be overriden at link time.  See this page for more details:

 * https://en.wikipedia.org/wiki/Weak_symbol

 */

#define attribute_weak __attribute__((__weak__))

/*

 * Mark the function as a printf-style function.

 * @format_idx The index in the function argument list where the format string

 *             is passed (where the first argument is "1").

 * @check_idx The index in the function argument list where the first argument

 *            used in the format string is passed.

 * Some examples:

 *   foo([1] const char *format, [2] ...): format=1 check=2

 *   foo([1] int, [2] const char *format, [3] ...): format=2 check=3

 *   foo([1] const char *format, [2] const char *, [3] ...): format=1 check=3

 */

#define attribute_printf(format_idx, check_idx)                                \

  __attribute__((__format__(__printf__, format_idx, check_idx)))

/*

 * The specified function arguments may not be NULL.  Params starts counting

 * from 1, not 0.  If no params are specified, then all function arguments are

 * marked as non-NULL.  Thus, params should only be specified if a function

 * accepts NULL pointers for any of the arguments.

 * NB: Keep in sync with libminijail.h style.

 */

#define attribute_nonnull(params) __attribute__((__nonnull__ params))

#ifndef __cplusplus

/* If writing C++, use std::unique_ptr with a destructor instead. */

/*

 * Mark a local variable for automatic cleanup when exiting its scope.

 * See attribute_cleanup_fp as an example below.

 * Make sure any variable using this is always initialized to something.

 * @func The function to call on (a pointer to) the variable.

 */

#define attribute_cleanup(func) __attribute__((__cleanup__(func)))

/*

 * Automatically close a FILE* when exiting its scope.

 * Make sure the pointer is always initialized.

 * Some examples:

 *   attribute_cleanup_fp FILE *fp = fopen(...);

 *   attribute_cleanup_fp FILE *fp = NULL;

 *   ...

 *   fp = fopen(...);

 *

 * NB: This will automatically close the underlying fd, so do not use this

 * with fdopen calls if the fd should be left open.

 */

#define attribute_cleanup_fp attribute_cleanup(_cleanup_fp)

static inline void _cleanup_fp(FILE **fp)

{

  if (*fp)

    fclose(*fp);

}

Unexecuted instantiation: libminijail.c:_cleanup_fp

Unexecuted instantiation: syscall_filter.c:_cleanup_fp

Unexecuted instantiation: signal_handler.c:_cleanup_fp

Unexecuted instantiation: bpf.c:_cleanup_fp

Unexecuted instantiation: landlock_util.c:_cleanup_fp

Unexecuted instantiation: util.c:_cleanup_fp

Unexecuted instantiation: system.c:_cleanup_fp

/*

 * Automatically close a fd when exiting its scope.

 * Make sure the fd is always initialized.

 * Some examples:

 *   attribute_cleanup_fd int fd = open(...);

 *   attribute_cleanup_fd int fd = -1;

 *   ...

 *   fd = open(...);

 *

 * NB: Be careful when using this with attribute_cleanup_fp and fdopen.

 */

#define attribute_cleanup_fd attribute_cleanup(_cleanup_fd)

static inline void _cleanup_fd(int *fd)

{

  if (*fd >= 0)

    close(*fd);

}

Unexecuted instantiation: libminijail.c:_cleanup_fd

Unexecuted instantiation: syscall_filter.c:_cleanup_fd

Unexecuted instantiation: signal_handler.c:_cleanup_fd

Unexecuted instantiation: bpf.c:_cleanup_fd

Unexecuted instantiation: landlock_util.c:_cleanup_fd

Unexecuted instantiation: util.c:_cleanup_fd

Unexecuted instantiation: system.c:_cleanup_fd

/*

 * Automatically free a heap allocation when exiting its scope.

 * Make sure the pointer is always initialized.

 * Some examples:

 *   attribute_cleanup_str char *s = strdup(...);

 *   attribute_cleanup_str char *s = NULL;

 *   ...

 *   s = strdup(...);

 */

#define attribute_cleanup_str attribute_cleanup(_cleanup_str)

static inline void _cleanup_str(char **ptr)

{

  free(*ptr);

}

Unexecuted instantiation: libminijail.c:_cleanup_str

Unexecuted instantiation: syscall_filter.c:_cleanup_str

Unexecuted instantiation: signal_handler.c:_cleanup_str

Unexecuted instantiation: bpf.c:_cleanup_str

Unexecuted instantiation: landlock_util.c:_cleanup_str

Unexecuted instantiation: util.c:_cleanup_str

Unexecuted instantiation: system.c:_cleanup_str

#endif /* __cplusplus */

/* clang-format off */

#define die(_msg, ...) \

  do_fatal_log(LOG_ERR, "libminijail[%d]: " _msg, getpid(), ## __VA_ARGS__)

#define pdie(_msg, ...) \

  die(_msg ": %m", ## __VA_ARGS__)

#define warn(_msg, ...) \

  do_log(LOG_WARNING, "libminijail[%d]: " _msg, getpid(), ## __VA_ARGS__)

#define pwarn(_msg, ...) \

  warn(_msg ": %m", ## __VA_ARGS__)

#define info(_msg, ...) \

  do_log(LOG_INFO, "libminijail[%d]: " _msg, getpid(), ## __VA_ARGS__)

#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))

/* clang-format on */

extern const char *const log_syscalls[];

extern const size_t log_syscalls_len;

extern const char *const libc_compatibility_syscalls[];

extern const size_t libc_compatibility_syscalls_len;

enum logging_system_t {

  /* Log to syslog. This is the default. */

  LOG_TO_SYSLOG = 0,

  /* Log to a file descriptor. */

  LOG_TO_FD,

};

/*

 * Even though this function internally calls abort(2)/exit(2), it is

 * intentionally not marked with the noreturn attribute. When marked as

 * noreturn, clang coalesces several of the do_fatal_log() calls in methods that

 * have a large number of such calls (like minijail_enter()), making it

 * impossible for breakpad to correctly identify the line where it was called,

 * making the backtrace somewhat useless.

 */

extern void do_fatal_log(int priority, const char *format, ...)

    attribute_printf(2, 3);

extern void do_log(int priority, const char *format, ...)

    attribute_printf(2, 3);

static inline int is_android(void)

{

#if defined(__ANDROID__)

  return 1;

#else

  return 0;

#endif

}

Unexecuted instantiation: libminijail.c:is_android

Unexecuted instantiation: syscall_filter.c:is_android

Unexecuted instantiation: signal_handler.c:is_android

Unexecuted instantiation: bpf.c:is_android

Unexecuted instantiation: landlock_util.c:is_android

Unexecuted instantiation: util.c:is_android

Unexecuted instantiation: system.c:is_android

static inline bool compiled_with_asan(void)

{

#if defined(__SANITIZE_ADDRESS__)

  /* For gcc. */

  return true;

#elif defined(__has_feature)

  /* For clang. */

  return __has_feature(address_sanitizer) ||

         __has_feature(hwaddress_sanitizer);

#else

  return false;

#endif

}

Unexecuted instantiation: syscall_filter.c:compiled_with_asan

Unexecuted instantiation: signal_handler.c:compiled_with_asan

Unexecuted instantiation: bpf.c:compiled_with_asan

Unexecuted instantiation: landlock_util.c:compiled_with_asan

Unexecuted instantiation: util.c:compiled_with_asan

Unexecuted instantiation: system.c:compiled_with_asan

void __asan_init(void) attribute_weak;

void __hwasan_init(void) attribute_weak;

static inline bool running_with_asan(void)

{

  /*

   * There are some configurations under which ASan needs a dynamic (as

   * opposed to compile-time) test. Some Android processes that start

   * before /data is mounted run with non-instrumented libminijail.so, so

   * the symbol-sniffing code must be present to make the right decision.

   */

  return compiled_with_asan() || &__asan_init != 0 || &__hwasan_init != 0;

}

Unexecuted instantiation: libminijail.c:running_with_asan

Unexecuted instantiation: syscall_filter.c:running_with_asan

Unexecuted instantiation: signal_handler.c:running_with_asan

Unexecuted instantiation: bpf.c:running_with_asan

Unexecuted instantiation: landlock_util.c:running_with_asan

Unexecuted instantiation: util.c:running_with_asan

Unexecuted instantiation: system.c:running_with_asan

static inline bool debug_logging_allowed(void)

{

#if defined(ALLOW_DEBUG_LOGGING)

  return true;

#else

  return false;

#endif

}

Unexecuted instantiation: libminijail.c:debug_logging_allowed

Unexecuted instantiation: syscall_filter.c:debug_logging_allowed

Unexecuted instantiation: signal_handler.c:debug_logging_allowed

Unexecuted instantiation: bpf.c:debug_logging_allowed

Unexecuted instantiation: landlock_util.c:debug_logging_allowed

Unexecuted instantiation: util.c:debug_logging_allowed

Unexecuted instantiation: system.c:debug_logging_allowed

static inline bool seccomp_default_ret_log(void)

{

#if defined(SECCOMP_DEFAULT_RET_LOG)

  return true;

#else

  return false;

#endif

}

Unexecuted instantiation: libminijail.c:seccomp_default_ret_log

Unexecuted instantiation: syscall_filter.c:seccomp_default_ret_log

Unexecuted instantiation: signal_handler.c:seccomp_default_ret_log

Unexecuted instantiation: bpf.c:seccomp_default_ret_log

Unexecuted instantiation: landlock_util.c:seccomp_default_ret_log

Unexecuted instantiation: util.c:seccomp_default_ret_log

Unexecuted instantiation: system.c:seccomp_default_ret_log

static inline bool block_symlinks_in_bindmount_paths(void)

{

#if defined(BLOCK_SYMLINKS_IN_BINDMOUNT_PATHS)

  return true;

#else

  return false;

#endif

}

Unexecuted instantiation: libminijail.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: syscall_filter.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: signal_handler.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: bpf.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: landlock_util.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: util.c:block_symlinks_in_bindmount_paths

Unexecuted instantiation: system.c:block_symlinks_in_bindmount_paths

static inline bool block_symlinks_in_noninit_mountns_tmp(void)

{

#if defined(BLOCK_SYMLINKS_IN_NONINIT_MOUNTNS_TMP)

  return true;

#else

  return false;

#endif

}

Unexecuted instantiation: libminijail.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: syscall_filter.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: signal_handler.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: bpf.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: landlock_util.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: util.c:block_symlinks_in_noninit_mountns_tmp

Unexecuted instantiation: system.c:block_symlinks_in_noninit_mountns_tmp

static inline size_t get_num_syscalls(void)

{

  return syscall_table_size;

}

Unexecuted instantiation: libminijail.c:get_num_syscalls

Unexecuted instantiation: syscall_filter.c:get_num_syscalls

Unexecuted instantiation: signal_handler.c:get_num_syscalls

Unexecuted instantiation: bpf.c:get_num_syscalls

Unexecuted instantiation: landlock_util.c:get_num_syscalls

Unexecuted instantiation: util.c:get_num_syscalls

Unexecuted instantiation: system.c:get_num_syscalls

int lookup_syscall(const char *name, size_t *ind) attribute_nonnull((1));

const char *lookup_syscall_name(long nr);

long int parse_single_constant(char *constant_str, char **endptr)

    attribute_nonnull();

long int parse_constant(char *constant_str, char **endptr)

    attribute_nonnull((1));

/*

 * parse_size: parse a string to a positive integer bytes with optional suffix.

 * @size     The output parsed size, in bytes

 * @sizespec The input string to parse

 *

 * A single 1-char suffix is supported like "10K" or "6G".  These use base 1024,

 * not base 1000.  i.e. "1K" is "1024".  It is case-sensitive.

 *

 * Returns 0 on success, negative errno on failure.

 * Only writes to |size| on success.

 */

int parse_size(uint64_t *size, const char *sizespec) attribute_nonnull();

char *strip(char *s) attribute_nonnull();

/*

 * streq: determine whether two strings are equal.

 */

attribute_nonnull() static inline bool streq(const char *s1, const char *s2)

{

  return strcmp(s1, s2) == 0;

}

Unexecuted instantiation: libminijail.c:streq

Unexecuted instantiation: syscall_filter.c:streq

Unexecuted instantiation: signal_handler.c:streq

Unexecuted instantiation: bpf.c:streq

Unexecuted instantiation: landlock_util.c:streq

Unexecuted instantiation: util.c:streq

Unexecuted instantiation: system.c:streq

/*

 * tokenize: locate the next token in @stringp using the @delim

 * @stringp A pointer to the string to scan for tokens

 * @delim   The delimiter to split by

 *

 * Note that, unlike strtok, @delim is not a set of characters, but the full

 * delimiter.  e.g. "a,;b,;c" with a delim of ",;" will yield ["a","b","c"].

 *

 * Note that, unlike strtok, this may return an empty token.  e.g. "a,,b" with

 * strtok will yield ["a","b"], but this will yield ["a","","b"].

 */

char *tokenize(char **stringp, const char *delim);

char *path_join(const char *external_path, const char *internal_path)

    attribute_nonnull();

/*

 * path_is_parent: checks whether @parent is a parent of @child.

 * Note: this function does not evaluate '.' or '..' nor does it resolve

 * symlinks.

 */

bool path_is_parent(const char *parent, const char *child) attribute_nonnull();

/*

 * consumebytes: consumes @length bytes from a buffer @buf of length @buflength

 * @length    Number of bytes to consume

 * @buf       Buffer to consume from

 * @buflength Size of @buf

 *

 * Returns a pointer to the base of the bytes, or NULL for errors.

 */

void *consumebytes(size_t length, char **buf, size_t *buflength)

    attribute_nonnull();

/*

 * consumestr: consumes a C string from a buffer @buf of length @length

 * @buf    Buffer to consume

 * @length Length of buffer

 *

 * Returns a pointer to the base of the string, or NULL for errors.

 */

char *consumestr(char **buf, size_t *buflength) attribute_nonnull();

/*

 * init_logging: initializes the module-wide logging.

 * @logger       The logging system to use.

 * @fd           The file descriptor to log into. Ignored unless

 *               @logger = LOG_TO_FD.

 * @min_priority The minimum priority to display. Corresponds to syslog's

 *               priority parameter. Ignored unless @logger = LOG_TO_FD.

 */

void init_logging(enum logging_system_t logger, int fd, int min_priority);

/*

 * logging_to_syslog: report whether the active logging backend is syslog.

 *

 * Returns true when logging is handled by syslog, false otherwise.

 */

bool logging_to_syslog(void);

/*

 * minjail_free_env: Frees an environment array plus the environment strings it

 * points to. The environment and its constituent strings must have been

 * allocated (as opposed to pointing to static data), e.g. by using

 * minijail_copy_env() and minijail_setenv().

 *

 * @env The environment to free.

 */

void minijail_free_env(char **env);

/*

 * minjail_copy_env: Copy an environment array (such as passed to execve),

 * duplicating the environment strings and the array pointing at them.

 *

 * @env The environment to copy.

 *

 * Returns a pointer to the copied environment or NULL on memory allocation

 * failure.

 */

char **minijail_copy_env(char *const *env);

/*

 * minjail_setenv: Set an environment variable in @env. Semantics match the

 * standard setenv() function, but this operates on @env, not the global

 * environment. @env must be dynamically allocated (as opposed to pointing to

 * static data), e.g. via minijail_copy_env(). @name and @value get copied into

 * newly-allocated memory.

 *

 * @env       Address of the environment to modify. Might be re-allocated to

 *            make room for the new entry.

 * @name      Name of the key to set.

 * @value     The value to set.

 * @overwrite Whether to replace the existing value for @name. If non-zero and

 *            the entry is already present, no changes will be made.

 *

 * Returns 0 and modifies *@env on success, returns an error code otherwise.

 */

int minijail_setenv(char ***env, const char *name, const char *value,

        int overwrite);

/*

 * getmultiline: This is like getline() but supports line wrapping with \.

 *

 * @lineptr    Address of a buffer that a mutli-line is stored.

 * @n          Number of bytes stored in *lineptr.

 * @stream     Input stream to read from.

 *

 * Returns number of bytes read or -1 on failure to read (including EOF).

 */

ssize_t getmultiline(char **lineptr, size_t *n, FILE *stream)

    attribute_nonnull();

/*

 * minjail_getenv: Get an environment variable from @envp. Semantics match the

 * standard getenv() function, but this operates on @envp, not the global

 * environment (usually referred to as `extern char **environ`).

 *

 * @env       Address of the environment to read from.

 * @name      Name of the key to get.

 *

 * Returns a pointer to the corresponding environment value. The caller must

 * take care not to modify the pointed value, as this points directly to memory

 * pointed to by @envp.

 * If the environment variable name is not found, returns NULL.

 */

char *minijail_getenv(char **env, const char *name);

/*

 * minjail_unsetenv: Clear the environment variable @name from the @envp array

 * of pointers to strings that have the KEY=VALUE format. If the operation is

 * successful, the array will contain one item less than before the call.

 * Only the first occurence is removed.

 *

 * @envp      Address of the environment to clear the variable from.

 * @name      Name of the variable to clear.

 *

 * Returns false and modifies *@envp on success, returns true otherwise.

 */

bool minijail_unsetenv(char **envp, const char *name);

#ifdef __cplusplus

}; /* extern "C" */

#endif

#endif /* _UTIL_H_ */